Separate documents from signature metadata
ASiC uses a ZIP-based container to keep documents and signature-related material together. This opener recognizes supported ASiC-S and ASiC-E mimetype entries. It extracts ordinary document entries outside META-INF and records the metadata filenames. It does not interpret those metadata files as proof that the listed documents were correctly signed.
The original ASiC download retains the entire input package, including META-INF files and the original ZIP structure. The extracted-document bundle contains the extracted files and a report only. That bundle is convenient for reading and handoff, but it is not an equivalent signed archive and should not replace the original in a verification process.
Review each container path
A document can itself contain a supported CMS or ASiC container. The opener follows bounded nesting and reports paths such as archive.asice!/folder/document.pdf.p7m!/content. These paths explain where an extracted file came from; they do not establish that every outer and inner signature covers the same bytes or has the same signer.
Names are cleaned for safe downloads, and duplicate basenames receive distinct suffixes. The report retains the original container paths so two files from different folders are not mistaken for one another. An ordinary nested ZIP remains an unchanged downloadable document rather than being treated as an arbitrary archive to unpack recursively.
Keep partial extraction visible
Processing is limited to four nested levels, 128 extracted documents, 24 MiB per document and 64 MiB of expanded content. ZIP entry and ASN.1 depth/node limits also bound malformed or unexpectedly large inputs. An unsupported nested file can remain available unchanged with a specific issue, instead of having its contents guessed.
Read every issue before relying on a document count. A detached signature may have no embedded payload, and an encrypted inner container cannot be opened without the right key and application. None of these outcomes determines whether the surrounding signature is valid. Preserve the original archive and resolve content or verification questions using the source package and an appropriate validation workflow.